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Abstract 

Formal robustness analysis of aircraft control upset prevention and recovery systems could play an im- 
portant role in their validation and ultimate certification. As a part of the validation process, this paper 
describes an analysis method for determining a reliable flight regime in the flight envelope within which 
an integrated resilent control system can achieve the desired performance of tracking command signals and 
detecting additive faults in the presence of parameter uncertainty and unmodeled dynamics. To calculate a 
reliable flight regime, a structured singular value analysis method is applied to analyze the closed- loop sys- 
tem over the entire flight envelope. To use the structured singular value analysis method, a linear fractional 
transform (LFT) model of a transport aircraft longitudinal dynamics is developed over the flight envelope 
by using a preliminary LFT modeling software tool developed at the NASA Langley Research Center, which 
utilizes a matrix-based computational approach. The developed LFT model can capture original nonlinear 
dynamics over the flight envelope with the A block which contains key varying parameters: angle of attack 
and velocity, and real parameter uncertainty: aerodynamic coefficient uncertainty and moment of inertia 
uncertainty. Using the developed LFT model and a formal robustness analysis method, a reliable flight 
regime is calculated for a transport aircraft closed-loop system. 
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Aircraft 

parameters 


a 

angle of attack (AOA), (rad) 

4 

q 

pitch angle rate, {rad/ sec) 


V 

True airspeed, {m/sec) 

T 

9 

Pitch angle, (rad) 

c 

1 

flight path angle, (deg) 

q 

m 

total mass, {kg) 

C7 

Szeng 

summation of z positions of engines, (to) 



elevator deflection, (deg) 
stabilizer deflection, (rad) 
thrust, (TV) 

mean chord length, (m) 

dynamic pressure, {N /rn?) 

inertia coefficient, ^/lyy, (kg~^m~^) 


Aerodynamic coefficients 


Cl 

Cm 

Cm...... 


drag coefficient at fixed mach number 
total lift coefficient 

lift coefficient for the rigid airplane at zero stabilizer angle 
pitch moment coefficient 

pitch moment coefficient for the rigid airplane at zero stabilizer angle 


1 Introduction 


Aircraft loss-of-control (LOG) accidents [1-3] comprise a significant aircraft accident category across all civil 
transport classes, and can result from a large array of causal and contributing factors (e.g., system and 
component failures, control system impairment or damage, inclement weather, inappropriate pilot inputs, 
etc.) occurring either individually or in combination. Research [4-7] into the characterization of the aircraft 
LOG phenomenon as well as LOG prevention and recovery system technologies is being conducted by NASA 
as a part of its Aviation Safety Program (AvSP). In Ref. [8], it is shown that loss-of-control events can 
involve flight beyond normal operating conditions. Moreover, these conditions are not well modeled in 
current transport simulations. Validation of both the mathematical models and the systems technologies for 
LOG conditions is therefore highly nontrivial. 

Gertification of LOG prevention and recovery systems (including failure detection, identification, and re- 
configuration as well as upset recovery subsystems) for an aircraft will require a comprehensive validation 
process (integrating analysis, simulation, and experimental methods) to ensure the safety and reliability of 
these systems over the entire flight envelope. Robustness analysis for systems with structured uncertainty 
could play an important role in this process. For an aircraft control system, robustness to nonlinear param- 
eter variations over the flight envelope and at extreme flight conditions must also be considered. Ref. [9] 
provides an excellent treatment of applying robustness analysis methods to the clearance of flight control 
laws, and Ref. [5] provides a robustness analysis framework for failure detection and accommodation sys- 
tems. Analytical robust control methods, such as the structured singular value method (/x-analysis method 
in Refs. [5,9]), have been applied for the clearance of a flight control law in Ref. [10]. The linear fractional 
transformation (LFT) model of an aircraft has been constructed with a parameter uncertainty and linearized 
models of the aircraft at each trim condition [10]. The LFT model in Ref. [10] can capture dynamics change 
due to the uncertain parameters but not to flight condition variation. 
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One of the clearance techniques for a flight control law is polynomial-based analysis in Ref. [11] that 
checks the robust stability of a dynamic system by looking at the uncertain coefficients of the characteristic 
polynomial, which is a function of flight condition. In Ref. [11], the safety flight envelope is calculated 
based on the eigenvalues of the system evaluated at the given flight condition over the flight envelope using 
the adaptive gridding approach. In this paper, the desired performance level of a closed-loop system is 
represented by an induced £2 norm and is integrated with the robust analysis framework over the entire 
flight envelope. In robustness analysis of the system, the nonlinearity of the original dynamics due to 
flight condition variation is integrated with model uncertainty parameters. The nonlinearity and model 
uncertainties are represented by the A block of the LFT model which can capture the original nonlinear 
dynamics. 

Formulation of the LFT model can be extremely difficult and time consuming, especially for aircraft 
problems involving parametric uncertainties (see Refs. [5,9,12-16]). In fact, the difficulty in formulating 
the uncertainty model in LFT form has been a key impediment to performing robustness analysis for these 
systems. Ref. [1] presents a numerical matrix-based modeling method and preliminary software tool for 
computing LFT models from a polynomial system. 

In Ref. [17], an integrated fault identification and fault tolerant control system (hereafter called an IFTC 
system) of a transport aircraft is designed, which includes a fault tolerant control (FTC) law and fault 
detection and isolation (FDI) Alters. In Ref. [17], the FTC law is designed as an H^o control law to minimize 
command tracking errors under actuator fault occurrence, and the FDI Alter is designed based on an affine 
LPV model of the Boeing 747 aircraft to generate residual signals using a geometric approach [18]. The 
FTC law is designed based on a linearized model with given unmodeled dynamics, and is applied on the 
original nonlinear dynamics. Around a trim condition, the performance of the closed-loop system with the 
original nonlinear dynamics can be predicted but far from the trim point the performance of the closed-loop 
system cannot be predicted due to the nonlinearity. The conventional validation method for the closed-loop 
is nonlinear simulation with the pre-deflned time history of command signals. 

In this paper, the nonlinearity due to flight condition variation is converted into a LFT form of the 
system. The developed LFT model with the A block, which contains key parameters such as angle of attack 
and velocity, can capture the nonlinear dynamic variations over the flight envelope along with parameter 
uncertainty and unmodeled dynamics. Using the robustness analysis tool (/i-analysis), the closed-loop system 
can be evaluated over the flight envelope with the pre-deflned performance level that is typically defined as 
the induced-A 2 norm with the frequency weight function. This paper determines and presents a reliable 
flight regime, in which the IFTC system achieves the desired performance of command tracking and failure 
detection. 

This paper contains the following sections. In Section 2, the LFT modeling algorithm of the matrix-based 
computational approach is summarized. In Section 3, the analysis problem for the IFTC system is described. 
In Section 4, the LFT model of the longitudinal motion of the transport aircraft in Ref. [13] is developed over 
the given flight envelope. In Section 5, a robustness analysis framework and the calculated reliable flight 
regimes are described. In Section 6, nonlinear simulation results are described, and in Section 7 the results 
are summarized with conclusions. 
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2 Numerical Parameter LFT Modeling Approach 


For completeness, the matrix-based LFT modeling method presented in Refs. [1, 5] is briefly summarized. 
Consider a polynomial system as 


X 


A(p) 

B{p) 


X 

_y_ 


C(p) 

D{p)_ 


u 


where p G and m is the number of uncertain parameters. Assume that the matrices A(p), B{p), C{p) 
and D{p) are in multi- variable polynomial matrix form such as 


A{p) B{p) 
C{p) D{p) 


Ao Bq 
Co Do 






A. 


B^ 

D, 


flip), 


(2) 


where fi{p) is a multi-variable polynomial function and n/ is the total number of functions. The LFT 
model of the system of Eq. (1) to be solved is depicted in Fig. 1. The matrix A(p) contains the system 


A(p) 


R 


Figure 1: Block diagram of the LFT modeling problem 
uncertainties, and can be represented as follows for parametric uncertainties. 

A(p) — diag[(5i/7i,^ , ^2^n2, ' ' ' , (3) 

p = [61,62,- ■■ ,6m] (4) 

The LFT equation associated with Fig. 1 is given below 

S{p) = L{I - A{p)P)-^A{p)R +Q = Sa(p)+ Q, (5) 

where the matrix S{p) is a compact representation of the system model. The matrix P, R, and L are 
associated with the uncertainty block A{p). The matrix Q represents the nominal system model. The 
matrix Sa{p) can be solved for multivariate polynomial problems by replacing the matrix inversion with a 
finite series expansion and a nilpotency condition, 

Sa{p) = bar + L[AP + (AP)2 + . . . + {APy]AR (6) 

{APy+^ = 0 (7) 

where r is determined by the degree of the largest nonzero term in Sa{p)- 

The blocks of L and R, and the main-diagonal blocks of P are solved simultaneously for each uncertain 
parameter 6i using all single-parameter n*^-order terms, and the off-diagonal blocks of P are each solved 
using the appropriate cross terms of Sa{p)- The detailed procedures are described in Refs. [1,5]. 
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3 Analysis Problem Statement for The IFTC System 


The IFTC system of the Boeing 747-100/200 aircraft presented in Ref. [17] is briefly described here to carry 
out the analysis problem of the system over a flight envelope. The IFTC system shown in Fig. 2 contains 
a fault tolerant control law, fault detection and isolation Alters, actuators and sensors. In Ref. [17], the 



Figure 2: The simplified block diagram of the IFTC system of a transport aircraft in Ref. [13]. 

fault tolerant control law was designed as a passive fault tolerant control law minimizing flight-path angle 
and velocity command tracking errors in the presence of actuator faults. Actuator faults are modeled as 
additive signals on each control channel. In Ref. [17], the LPV-FDI Alters were designed, based on the affine 
LPV model of the longitudinal motion of the Boeing 747-100/200 aircraft, as residual generators using the 
geometric approach [18]. Note that in this paper, the linearized FDI filters around a trim point are used for 
robustness analysis of the IFTC system. 

In this paper, the analysis problem is considered as “in what region of the flight envelope can the designed 
system achieve the desired closed-loop performance level of tracking commands and detecting additive faults 
in the presence of parameter uncertainty and unmodeled dynamics ?”. Generally, the flight region to be 
determined is hereafter called the reliable flight regime. The reliable flight regime is dependent on nonlinear 
dynamics changes over the flight envelope, the desired performance level, maximum allowable command size, 
additive faults, and system uncertainties. 

To analyze the IFTC system over the entire flight envelope, the augmented IFTC system is constructed 
with performance weighing functions (Wp and Wf), a fault scale matrix (Fg), a command scale matrix (Cg) 
and ideal closed-loop dynamics (Ti) and is shown in Fig. 3. The performance weight function, Wp, and 
ideal response, Ti, can be defined to represent the desired performance, command tracking error, and the 
weighting function Wf can be designed based on the desired fault detection accuracy for additive faults by 
representing detection accuracy as the desired residual generation due to additive faults. The matrices, Cg 
and Fg, can represent possible maximum size of command and additive faults, respectively. Note that in 
the augmented closed-loop system, the nonlinear aircraft dynamics are replaced with the LFT model with 
the block Amodeiicx, V). The block Amodei is decoupled into two components: a component, Am(o:,V), 
which is flight condition dependent, and an uncertainty component, A^c, which represents real param- 
eter uncertainty whose size is constant over the flight envelope. The block A^odei(oi,V) is rewritten as 


5 









Figure 3: Augmented closed-loop interconnection block diagram of the IFTC system of a transport aircraft. 



diag{[Am{ce,V), Amc])- The block Aact shown in Fig. 3 represents unmodeled actuator dynamics. The 
augmented IFTC system is converted into the generalized block diagram shown in Fig. 4 with the uncertain 
block A = diag{Amodeh Aact}, which is useful for robustness analysis (/x-analysis) . 

For the robustness analysis of the IFTC system, robust performance in an Hoo sense for the subsystems 
{Mpc, Mpf, Mrc, and Mr/) shown in Fig. 4 is interpreted as follows: 


1. fi{Mpc): Robustness to command tracking errors in control performance over the entire flight envelope 
in the presence of real parameter uncertainty and unmodeled dynamics. 

2. /i(Mr/): Robustness to fault detection errors in FDI Alter performance over the entire flight envelope 
in the presence of real parameter uncertainty and unmodeled dynamics. 

3. ii{Mpf): Effect of faults on performance level at a trim condition. 

4. ii{Mrc)' Effect of commands on residual signals generated by the FDI Alters. 

In this paper, the reliable flight envelope of acceptable command tracking error in the presence of faults 
and the uncertainty is defined as 

£pcf = {(a,V) I {a,V)€Tc, G (8) 

II J\ ||2 


6 











where the set Te is the entire flight envelope and the uncertainty set ^mca is deflned as 

^mca = ^act)} 

^mc — j ‘ ‘ ' ^rn^7i\) } |^ri| ^ I5 ^ri ^ 

^act — {dzn^( [(5cl , * * * ^ I5 ^ci ^ tl} 

Here, 6ri and Sd represent real and complex parameter uncertainties. The complex uncertainty Sd is related 
to unmodeled dynamics. Eq. (8) implies that the system in the reliable flight regime can achieve the desired 
performance level with robustness to the uncertainty described by the block Amca- 

Calculating the boundary of the set £pcf is not easy via nonlinear simulation results since it is dependent 
on command time history, additive faults, and all elements of the uncertainty block A^ca- The problem is 
converted into calculating approximation of the set via 

£pcf = Ui ^pcf,i 

= Ua(a,h^) I PRPM{Mp,f,A)>l, {a,V)&Ti} 

— ^pcf 

where 

A = diag(^[Ajn(^a,V) , A 

me-) Aflct] ) 

Mpef = [Mp, Mpf] 

= {(^5 I ^min A A O^rnaxj^min A V A ^max} 

Here, papM^Mpef, A), a robust performance margin of Tu{Mpcf , A), is deflned as 

PRPM{Mpcf,A) = — — — 

maXujp{Mpcf) 

with the normalized A. 

A reliable flight regime is calculated as the following iterative process. 

1. Initial Ti is deflned as Te- Calculate a performance margin, prpm, of lF„(Mpc/, A) with (a, V), € Ti. 
Note that 1F„ denotes an upper LET. 

2. When prpm A 1, the subset Ti is in a reliable flight regime. This iteration is terminated. 

3. When prpm < 1, the subset boundary amin,o:max,Vmin, and Vmax are rescaled with the performance 
margin. This leads to a new subset, Ti+i. Then go to the step one. 

After this process, the set Tt (shown in Figure 5), one of the iteration results, is deflned as 

Tt = {{a,V) I < a < < E < E*_}. (13) 

The reliable flight region £pcf lies between the boundary of Tt and Te such as 

Tt C £pcf C Te (14) 


( 10 ) 


( 11 ) 


(12) 
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Figure 5: Illustrated plots for flight envelope and calculated subsets. 


seen as the illustrated plot in Figure 5 since singular value analysis leads to conservative results of the 
uncertain parameter domains of (a, V). For a more accurate boundary of a calculated reliable flight regime, 
a reliable flight envelope subset is defined as 

— {(^5 I ^min ^ O; ^ O^rnax: ^min ^ ^ ^max\ 

where 

— ^min ^ ^trim ^ ^max ^ ^tmax (16) 

^ ^min ^ Vtrim ^trim ^ ^max ^ 

An optimization problem to calculate the parameters, amin, Q^max, Vmin, and Vmax, is formulated as 

min \pRPM{Mpcf,A{a 

min •) ^max : V„,,n,V^ax)) - l\- (17) 

amin,ama^,Vmin,Vma^ 

To solve the optimization problem, the following steps are used. For example, to calculate a parameter Vmax 
(unknown parameter), the other parameters are fixed as 


O^min — P^trim V (1 

C^max — Q^trim “t” (1 

where p and q are any values between 0 and 1. The parameter Vmax is calculated as 

min \pRPM<yMpcf, A{Vmax)) ~ 1|- 


(18) 


(19) 


With these parameters, the set Spcf,i is defined as 

^pcf^i — {(^5 I ^min ^ ^ ^max^ ^min ^ ^ ^max}' 

To calculate another subset £pc/,i+i, Vmin is set as an unknown parameter and the other parameters are 
fixed. In this case, Vmax is set as Thus, an optimization is formulated as 

^ill \PRPM i^^pcf j 1|- (^1) 

After this process, the sum of these subsets is shown as the dashed-dot line box in Fig. 5. The similar process 
is repeated for amin and amax at fixed Vmin and Vmax such as 

Vmin ~ pVtrim T (1 (22) 

Vmax — OVtrim T (1 Q)^tmax 

The combined set of these subsets provided with the calculated amin and Umax is shown as the dotted line 
box in Fig. 5. The union of all subsets in Eq. 10 is calculated for different values of p and q in Eqs.(18) and 
(22), respectively. 


4 LFT Modeling of the Longitudinal Motion 


It is important to develop an accurate LFT model which can represent the original nonlinear dynamics of 
the longitudinal motion. This section presents the assumptions and procedures to reformulate the nonlinear 
equations of longitudinal motion into quasi-LPV polynomial form in Eq. (1). Then the LFT model is 
developed from the polynomial model. 


4.1 High Fidelity Nonlinear Model 


The full nonlinear equations of the Boeing 747 longitudinal motion are taken from Ref. [17] over the up- 
and-away flight regime. In this paper, the entire flight envelope J^e is defined as {(a,V) \ — 2 < a < 
10{deg), 150 <V< 250(m/sec)} at an altitude of 7000 to. The detailed nonlinear equations of motion are 


q = 


-|-[— ^^(sina -I- 0.0436 cos a)]T + A (sin a sin 6* -I- coso;cos6l)g — 

‘"’Iv' “ 1(1-45 - l.Sxc.g.)^ (cos axc.g. -k sina^c.g.)]^ 

+C7qScKa[^^ - |^(cosaCc.g. -ksinazc.g.)]^e 
+C’jqScKa + CrS^engT + CrqScCmtasiSo^J 

+C7qS[CDMaahi^^^L)(cosaZc.g. ~ siutt^c.g.) - M){cosaXc.g. -k sin aZc.g. 

AM, Cl) 


(23) 

(24) 

(25) 

(26) 

Note that aerodynamic coefficients and their derivatives are calculated from the look-up tables described in 
Ref. [19]. The detailed definitions of aerodynamic coefficients are referred to Ref. [19,20]. 
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V = — (cos a — 0.0436 sin a)T + (sin a cos 0 — cosasm9)g Cd 

TO TO 


9 = q 
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4.2 Quasi-LPV Polynomial Model of the Transport Aircraft 


To develop a quasi-LPV polynomial model, the aerodynamic coefficients are fit into a polynomial function 
form such that 

a = [a" ■■■if + 6a (27) 

where a is an aerodynamic coefficient, Ca is a coefficient matrix and 5a is the fitting error which is treated 
here as real parameter uncertainty of the quasi-LPV model, here. The detailed polynomial fit aerodynamic 
coefficients are given in Ref. [20]. In this example, for simplicity, the three largest fitting errors among 
the aerodynamic coefficients are considered as parameter uncertainties which are not dependent on angle of 
attack and velocity, i.e. \5cli, \ < 0.025, \6cor^ \ ^ 0.01, and € [—18.43 — 17]. With the assumption that 
the moment of inertia (lyy) uncertainty is 5 percent of the nominal value (4527800 Kgrn?), 5j^^ is defined. 
In this example, the four uncertainties are considered real parameter uncertainties. 

Using the polynomial fitted aerodynamic coefficients, the longitudinal motion is rewritten as 


d 


a 




g/V 

q 

= A{a, V, 6mc) 

q 

+ B(a, V, Smc) 

Je 

J. 

+ 

0 

V 


V 




0 

0 


0 




0 


where 5mc = [5 cli, 5cDm. ^lyyV ■ The quasi-LPV model of the nonlinear polynomial model in Eq. (28) 
is developed using the function substitution method [19,21-23] to convert the term g/V into quasi-LPV 
form. The benefit of the function substitution method is that the generated LPV model can represent the 
nonlinear dynamics without linear approximation (such as Jacobian linearization) over the entire possible 
flight region. Note that the state transformation method [21,24,25] can also provide an LPV representation 
of a nonlinear system without linear approximation. There is, however, the limitation that the LPV model 
should be inside equilibrium manifolds. 


To apply the function substitution method, states of the model are defined as the deviation from a 
reference point such as 

a = a-at, V=V-Vt, e = d-9t, (29) 

where a reference point is chosen as a trim point: («t, 0, V), 0(). Note that at = Ot for level flight under a 
trim condition. Using Eq. (29), Eq.(28) is rewritten as 

X = A{a,V,6mc){xt + x) + B{a,V,6mc){ut + u) + [g/V 0 0 0]^, 

4 ( 0 , U, 5^f/jx J- R(oi, U, 4“ h(^a^ ^)? 

where 

h{a,V) = A{a,V)xt + B{a,V)ut + [g/V 0 0 0]^. (31) 

Note that the control u is [5^ — Jet ~ J«t T — TtY" and the trim value Ut is [Jet , J«t ; T)]^. Note that the 
stabilizer is used only as a trimming device. Thus, the control inputs are considered as elevator and thrust 
in this example. 
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After algebraic manipulations, Eq. (31) is rewritten as 



ha 


0 

hay 




h{a, E) = 

hq 

= 

^<Ja 

hqy 


a 

(32) 


hv 


hVa 

hVy 


V 



_hg_ 


_ 0 

0 _ 



where the detailed function form of hay, hq^, 

hqv 

) ^Vo 

, , and hvy 

are omitted due to space limitations and 


are referred in Ref. [20]. Thus, the quasi-LPV model of the longitudinal motion of the transport aircraft in 
Eqs. (23)-(26) is 


i = {A{a, E, Srac) + H{V)} X + B{a, E, Smc)u (33) 


where 










0 

0 

hay 

0 




H{V) = 

^<Ja 

0 

hqy 

0 


(34) 



hVa 

0 

hVy 

0 





_ 0 

0 

0 

0 _ 



The detailed component matrices 

are available in Ref. 

[20]. Note that the quasi-LPV models 

are functions 


of a, V and the selected reference point. 


4.3 LFT Models of the Boeing 747-100/200 Aircraft 


A LFT model is obtained and normalized from the quasi-LPV model in Eq. (33) using the numerical matrix- 
based LFT model tool (NT) [1] and the Robust toolbox (RT) in MATLAB, respectively. Recall that it is 
demonstrated in Ref. [1] that the two software tools can generate accurate LFT models which can represent 
the original nonlinear dynamics. 

A LFT model is dependent on reference point selection since the model in Eq. (33) is dependent on a 
reference point which is one of the trim points. In this example, four reference points are chosen as trim 
points and are shown in Table 1. The four reference points are calculated to trim the aircraft dynamics at 
a given velocity and zero elevator deflection angle. 

The developed LFT models have the block Amodei such that 

Ajnodel — dzft^([A^(o, F),A„,]) 

= diag{[6ylex6i ^a, ^Com. ^Cm„ 
where Vmin < 5v < Vmax and ^min <<5a < ^max ■ 


5 Reliable Flight Regime Analysis Results 


To calculate a reliable flight regime of the IFTC system of the aircraft, the desired performance levels are 
required, which are described by the weighting functions in Fig. 3. The command tracking performance 
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Reference points 

a (deg) 

V (m/sec) Se (deg) 

8 g (deg) 

T (N) 

point 1 (PI) 

4.1 

180 

0 

-0.3 

4.6 xlO^ 

point 2 (P2) 

2.6 

200 

0 

0.1 

4.1 xlO^ 

point 3 (P3) 

1.7 

215 

0 

0.4 

4.1 xlO^ 

point 4 (P4) 

0.9 

230 

0 

0.7 

4.3 xlO^ 


Table 1: Four reference points 


weighting function Wp is defined as 


Wp = diag{ 


40(s/100 + l) 100(s/100 + l) 
s/0.005+ 1 ’ s/0.005 + 1 


(36) 


to allow the flight path angle and the velocity to track their commands in the 2.5% and 1 % error ranges 
over the low frequency region, respectively. The block in Fig. 3 describes the ideal command tracking 
responses of 7 and V, which is selected as 


Ti = diag( 


0.352 


0.152 


s2 + 0.7s + 0.352’ 0.3s + 0.152 


), 


(37) 


the second order transfer functions for the ideal closed-loop responses of 7 and V. The desired performance 
level is defined as the error between the ideal response and the closed-loop measurement described as an 
induced £2 norm value. Recall that the matrix Cg represents allowable maximum size of command signals 
(jcmd and Vcmd)- Here, three cases are considered as follows: 


Cgi 

= diag{l deg, 1 mj sec) 

(38) 

Cg2 

= diag{5deg, 5mjsec) 

(39) 

Cg3 

= diag {10 deg, 10 m/sec). 

(40) 


The fault scale matrix 
faults in the elevator and 
chosen as 


Fg in Fig. 3 is set as diag{lQ, 10000) to represent 10 deg and 10000 N additive 
the throttle channels, respectively. The fault detection weighting function Wf is 


Wf = diag{ 


0.35(s/1000+ 1)2 
(s/0.5 + 1)2 


0 .002(s/1000 + 
(s/0.1 + 1)2 


1)^ 


(41) 


to represent about 3 deg and 500 N detection errors for 10 deg elevator fault and 10000 N throttle fault, 
over the low frequency range. The actuator models [17] are for the elevator actuator and 77^ for 

the throttle actuator. Here, the unmodeled actuator dynamics are defined as 

to represent 10% unmodeled dynamics over the low frequency range (< 10 r/s) and 500% over the high 
frequency range (> 500 r/s). The uncertainty associated with the unmodeled dynamics is defined as a 
complex number, A^ct = diag{ 6 i, 82 ) , 61^2 G C. The sensor model is approximated as an ideal sensor for 
consistency with Ref. [17]. 


The jd upper bound of each subsystem with the block A = diag{[Ajnodeh ^act]) is calculated using the 
Robust Toolbox over the entire flight envelope and shown in Table 2. It is noticed from Table 2 that the /r 
upper bounds for subsystems are dependent on reference point selection. The nominal dynamics of the LFT 


12 




reference points 

ft{Mpc) 

fi{Mpf) 




p.{Mrcf) 

point 1 (PI) 

1.21 

1.17 

1.23 

3.77 

1.15 

3.77 

point 2 (P2) 

1.11 

1.09 

1.12 

3.64 

1.10 

3.64 

point 3 (P3) 

1.11 

1.10 

1.11 

3.40 

1.11 

3.40 

point 4 (P4) 

1.04 

1.04 

1.04 

3.12 

1.05 

3.12 


Table 2: ^ upper bounds (/i) for each subsystem at each reference point with the command scale Cs 2 



IJ'iMpcf) 


reference points 

Csl 

Cs2 

Cs3 

Csl 

Cs2 

Cs3 

point 1 (PI) 

1.17 

1.23 

1.59 

1.76 

3.77 

5.28 

point 2 (P2) 

1.09 

1.12 

1.50 

1.76 

3.64 

5.09 

point 3 (P3) 

1.10 

1.11 

1.41 

1.62 

3.40 

4.73 

point 4 (P4) 

1.04 

1.04 

1.32 

1.55 

3.12 

4.31 


Table 3: /i upper bounds (/i) for each subsystem at each reference point with the different command matrices. 


model are defined by the selection of the reference point and the block Amodei of the LFT model captures 
the nonlinear dynamics from the nominal dynamics. Thus, the calculated fj, upper bound of subsystems can 
vary with reference points. 

It is observed from Table 2 that the /i upper bounds of are less than or equal to 1.23 for all cases. This 
means that the closed-loop system has robust performance in tracking commands with small degradation in 
the presence of faults, real parameter uncertainties, and unmodeled actuator dynamics. fl{Mpc) in Table 2 
represents robust command tracking in the presence of real parameter uncertainties and unmodeled actuator 
dynamics over the entire flight envelope. p,{Mpf) in Table 2 represents the fault effect on command tracking, 
which is shown as small values in Table 2. This means the closed-loop system is a fault tolerant system 
with robustness to the real parameter uncertainties and actuator unmodeled dynamics over the entire flight 
envelope with small performance degradation. 

It is observed from Table 2 that the /i upper bounds of Mrcf are larger than or equal to 3.12 for all cases. 
This implies that the FDI filters have large performance degradation on detecting additive faults. The large 
jl{Mrcf) in Table 2 are caused by the large p,{Mrc) which represents the coupling effect between command 
signals and residual signal generation. The small p,{Mrf) imply that the FDI filter can detect the additive 
fault within the pre-defined accuracy range (defined by Wf) in a steady state condition (zero command 
signals). To show the command signal size effect on robustness of subsystems, the /i upper bounds of the 
subsystems are calculated with different command cases: Cgi, Cg 2 i and defined in Eqs. (38)-(40), and 
are shown in Table 3. It is observed from Table 3 that the larger allowable command signals lead to more 
performance degradation and less performance robustness. Since the command signals affect residual signals 
of the FDI filters, the large variation on p,{Mrcf) is observed from Table 3 at a reference point. Now, reliable 
flight regimes for the fault tolerant control subsystem, Mpcf, are calculated using the method described in 
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Figure 6: The reliable flight regimes for Mpcf due to different reference points (symbol “+”) with the 
allowable commanding signal size Cs 2 - 




Figure 7: The reliable flight regimes for Mrcf at the different reference points with the allowable commanding 
signal size Cg 2 - 


Section 3 and shown in Fig. 6. PI, P2, P3, and P4 in Fig. 6 represent reference points given in Table 1 
and are shown as the “+” symbol. The solid rectangular line represents a reliable flight envelope calculated 
by the first iterative method. Using the method described in Section 3, the shaded regions are calculated 
as the subsets of the reliable flight envelope in this example. Reliable flight regimes for the FDI subsystem 
Mrcf are calculated and are shown in Fig. 7. This reliable flight regime is much smaller than that for the 
subsystem Mpcf due to the large command effect on residual signal generation. Based on Figs. 6 and 7, it 
can be predicted that when ^cmd and Vcmd are set as large signals as in the Csz case, the trajectory of V 
and a could be outside of the calculated reliable flight regime of Mrcf and inside of the reliable flight regime 
of Mpcf. The tracking error is expected to be small enough to achieve the pre-defined performance level 
(defined by Wp). It is, however, expected that the residual signals is varied due to variation in the command 
signals. This expected behavior will be validated via nonlinear simulation in the next section. 
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6 Simulation Results 


The IFTC system is simulated with different magnitudes of flight path angle and velocity commands in the 
presence of elevator and thrust faults. For all simulations, the elevator fault is set as a step signal with 10 
deg magnitude at 35 sec and the thrust fault is set as a step signal with 1000 N magnitude at 75 sec. The 
closed-loop system is simulated with zero command signals {'jcmd = Oj Vcmd = 0) and the above faults at 
each of the reference points. Simulation results are shown in Fig. 8. It is observed from Fig. 8 that the 
thrust residual signals generated by the FDI Alters are within 500 N error accuracy range for all reference 
points. It is also observed that there is a small coupling effect of the elevator faults at 35 sec. The elevator 
residual signals are also followed with the fault signals within a 3 deg error range for all reference points. 
The simulation results are matched with the robustness analysis results (Table 2) that p,{Mrf) is less than 
1.15 for all reference points. Note that the real parameter uncertainty is set as the worst-case uncertainty 
values from the robustness analysis results, i.e., A^c = djag([— 0.2, 0.4, — 0.3, 1]), for all simulations. The 




Figure 8: Residual signals at different reference points. 

closed- loop system is simulated with the command signals in the presence of faults at reference point 1. For 
all simulations, the flight path angle command is an 85 sec duration pulse beginning at 15 sec with 1 deg 
(Csi), 5 deg (C's2), and 10 deg (Css) magnitudes. The velocity command is a step at 75 sec with 1 m/sec 
(Csi), 5 m/sec (Cs 2 ), and 10 m/sec (Css) step sizes. The V and 7 time responses to the command signals are 
shown in Fig. 9. In the top plots, the dashed lines represent command signals for Csi, Cs 2 and Css cases, 
respectively. It is observed from the top plots that the closed-loop system can track the command signals 
within the desired performance level in the presence of the additive faults. Small oscillatory time responses 
of the 7 signals are observed at 35 sec due to the additive elevator faults. The bottom plots in Fig. 9 show 
the residual signals generated by the FDI Alters for each case. The dashed line presents the additive faults. 
The elevator residual signals can detect the fault signal within 3 deg accuracy. However, the thrust residual 
signals cannot follow the thrust fault signals. It is observed from Fig. 9 that the thrust residual signals have 
been affected by 7 command signals. The simulation results are matched with the robustness analysis results 
of Table 3. 

The trajectories of V and a for each time response of the closed-loop system are shown in Fig. 10 with the 
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Figure 9: Simulation results with different magnitude command signals. 
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Figure 10: Trajectories and reliable flight regimes for command signals. 
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reliable flight regime for M^-cf calculated in Section 5. The left top plot in Fig. 10 shows reliable flight regimes 
for command cases Cgi, Cs 2 , and at the reference point, PI. The largest command case leads to 
the smallest reliable flight regime due to the command effect on the residual signals. The right top plots 
in Fig. 10 shows that the trajectory is inside the reliable flight regime for Csi- It implies that the residual 
signals can detect the faults within the pre-deflned accuracy (IF/). It is matched with the simulation results 
on the bottom plot of Fig. 9. The left bottom plot of Fig. 10 shows that the trajectory is not inside the 
calculated reliable flight regime for Cg 2 - The right bottom plot shows that most of the trajectory is outside 
the calculated reliable flight regime for Css- These lower plots imply that the FDI Alters cannot generate 
residual signals within the pre-deflned accuracy range for these command cases (Cs 2 and Css). These results 
are matched with the time responses in Fig. 9 and the robust analysis results in Table 3. 


7 Conclusion 


In this paper, using the robust analysis tool, we calculate a reliable flight regime within the flight envelope 
of the IFTC system in which the desired performance level can be achieved in the presence of parameter 
uncertainty and unmodeled dynamics. To use the robust analysis tool, a LFT model of the longitudinal 
motion of a transport aircraft is generated based on polynomial quasi-LPV models which are developed for 
several reference points. Using the well-developed /t analysis method, the robustness of command tracking 
error, effect of command on fault detection errors, effect of fault on command tracking error, and fault 
detection error are calculated as fx upper bounds over the flight envelope in the presence of real parameter 
uncertainties and unmodeled dynamics. Using the presented analysis framework, the IFTC system of the 
transport aircraft is analyzed. The robust analysis results and the reliable flight regime analysis results are 
verified with nonlinear simulations of the closed-loop system. This analysis method could be extended to also 
consider robustness under noise or external disturbances (which are notoriously challenging for failure detec- 
tion). This analysis approach could be used for pre- flight test check-out, as well as part of a fully-developed 
validation and verification process. Future research will consider performance under highly nonlinear flight 
regimes as a part of the analysis. 
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